Newsroom / MetaMask

MetaMask says about 0.385 ETH in staking rewards was diverted in September breach

All affected validators run by MetaMask Staking have now exited. MetaMask says it found no evidence that staked principal, withdrawal keys or wallets were compromised, but some staking customers saw withdrawal delays and may have missed rewards.

November 5, 2026 · Announced · Verified 2026-11-07 via official announcement

MetaMask said on 5 November 2026 that an attacker who gained unauthorized access to part of its infrastructure, an incident it identified on 28 September, briefly changed the addresses that receive execution-layer staking rewards for certain Ethereum validators, diverting about 0.385 ETH. It said the change was found and addressed the same day and that all affected validators run by MetaMask Staking have now exited as a precaution.

The earlier updates on the same MetaMask page, dated 30 September and 1 October, gave no diverted amount; the 1 October update said there was no indication that wallets or customer funds had been affected. The new update says MetaMask has not identified evidence that the incident enabled access to or withdrawal of customers' staked principal, while adding that a limited amount of execution-layer rewards was diverted. An outside researcher had estimated about 0.36 ETH on 1 October, per CoinDesk.

MetaMask says it has identified no indication that its wallets or wallet infrastructure were compromised, that wallet users do not need to take any action, that it does not control the withdrawal keys for customers' staked ETH, and that the incident did not compromise Secret Recovery Phrases or private keys. It says the unauthorized access has been contained. The precautionary exits did have a cost: some customers saw temporary withdrawal delays, and rewards may have been missed while validators were exiting or awaiting reactivation. An exit is not the same as a withdrawal, and MetaMask notes funds can take additional time to become withdrawable or to be staked again.

Lido, whose protocol uses MetaMask Staking as a node operator, said on 30 September that the exit, withdrawal and re-entry cycle could take up to about 45 days and that stETH holders need not act. Lido governance has since set MetaMask Staking's target validator limit to zero, so no new deposits are allocated to it; that took effect on 23 October.

MetaMask has not said how the access happened, how many validators were affected or what it will pay affected customers; it says it is working with them directly. A researcher's estimate of about 17,000 validators holding roughly 523,000 ETH, reported by CoinDesk, has not been confirmed by MetaMask. BleepingComputer reports MetaMask is working to refund the lost rewards; MetaMask's update does not use that word.

“During the incident, an attacker briefly altered the addresses used to receive execution-layer staking rewards for certain validators, following unauthorized access to infrastructure where these addresses were centrally stored.”

— MetaMask, user update on recent security incident, 5 November 2026

Who this affects

Customers whose ETH was staked through validators run by MetaMask Staking, including through its Lido node operator. MetaMask says those customers should follow guidance from MetaMask or their staking provider. It says MetaMask wallet users need take no action.

MetaMask at a glance

More from the newsroom

• 2026-11-08 Consensys' Web3Auth pauses embedded wallets after flaw exposes Keplr social-login keys
• 2026-11-05 MetaMask adds limit orders to mobile swaps on four networks
• 2026-10-29 MetaMask adds Stellar as a default network on mobile and extension
• 2026-11-10 Binance to close Binance Pool, Cloud Mining and Pool Savings at 07:00 UTC on Nov. 10